This vulnerability is an unauthenticated PHP object injection in Novalnet Payment Gateway for WooCommerce versions up to 12.10.3. It arises from unsafe deserialization of untrusted data (CWE-502), enabling remote attackers to inject malicious PHP objects. The vulnerability has a critical CVSS 3.1 score of 9.8 with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems without authentication, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected plugin to prevent exploitation.